Customer data
No customer data stored.
No names, emails, addresses or individual orders. Orders become daily totals per code.
AT A GLANCE
Your store
Read-only by default.
Nothing changes unless you approve a fix or switch on an Autopilot rule.
Hosting
Dublin and London.
App functions in Dublin, the database in London.
Uninstall
Deleted after uninstall.
Shopify sends the erasure request about 48 hours later; we then delete your shop's data.
1. Who we are
This policy covers the CheckoutLeak Shopify app (“the app”), the website at checkoutleak.com and its early-access waitlist. The controller responsible for the personal data described here is CheckoutLeak (“we”, “us”).
For anything privacy related, email privacy@checkoutleak.com.
For the data inside a merchant’s Shopify store, the merchant is the controller and CheckoutLeak acts as a processor on the merchant’s behalf, under our Data Processing Addendum.
2. The Shopify app
What we read
- Catalog and promotions: products, variants, prices, costs and discounts.
- Orders, reduced to daily totals per discount code. We do not keep individual orders.
- Anonymous storefront activity, only once you turn on storefront insights. Our Shopify web pixel runs in Shopify’s sandbox, only fires where shoppers have given analytics consent, and sends the checkout step, device type, traffic-source class, product ID, a cart-value band and the type of checkout error a shopper sees (a rejected discount code is kept only as a keyed hash). It sets no cookies and is stored as daily counters, not as sessions or profiles. See cookies and storage.
- Your store’s owner email, only to send the weekly summary and alerts you have switched on. It is read from Shopify when an email is sent and is not stored.
- Settings you give us, such as your margin target, alert preferences and an optional Slack incoming-webhook URL.
What we never store
Customer names, emails, phone numbers, addresses or individual orders. Because we hold no customer personal data, Shopify’s customer data requests and customer erasure requests are acknowledged and recorded, and there is nothing further to return or delete.
What changes only with your approval
The app scans your store read-only. Discounts and products (prices, search text, descriptions, alt text, publishing and stock settings) change only through fixes you approve or Autopilot rules you switch on. Every change is verified in Shopify and can be undone.
Why we use it
We use this data to run scans, show findings and recommendations, apply fixes you approve, send the emails and alerts you choose, bill through Shopify and keep the service secure. The legal basis is the performance of our contract with you and, for security and service reliability, our legitimate interests. Storefront activity is only collected where the shopper has consented to analytics through Shopify’s customer privacy settings.
Logs and security records
Application logs carry IDs and counts only. We keep a security and lifecycle audit trail (for example: installs, plan changes, fixes applied and undone) to protect your store and answer support questions.
3. AI suggestions
AI suggestions are optional. When they are on, product images and text, and the numbers in your weekly summary, are sent to our AI subprocessors — OpenRouter and the model provider it routes the request to — only to write your suggestions (alt text, search text, description drafts and a line in the weekly email). They may not store your data or train on it: we only route to providers that do not store or train on request data. No customer data is sent. You approve every suggested change, unless you let an Autopilot rule act.
4. Website and waitlist
No tracking. checkoutleak.com sets no cookies and runs no analytics or advertising scripts. Details are in our cookies and storage notice.
Hosting. Our host, Vercel, processes standard request data (such as IP address, browser and requested page) to deliver the site and protect it from abuse.
Early-access waitlist. If you join the waitlist we store your email address, which list you joined, the page you signed up from and the time. We use it only to tell you when early access opens, based on your consent. Every email has an unsubscribe link, and you can ask us at any time to delete your address by writing to privacy@checkoutleak.com. To prevent abuse we store a one-way, keyed hash of your IP address (never the address itself) with your sign-up, so we can limit how many sign-ups one sender can make.
Your store’s address. When you join, we also store the store domain you enter, only to set up your first scan when we open. We don’t visit or scan it before you install.
Support. If you email us, we use your message and contact details to answer you.
5. Subprocessors
We use these service providers to run CheckoutLeak. Each processes data only on our instructions. Our subprocessors page has the full list, the data each one handles and how we announce changes.
| PROVIDER | PURPOSE | LOCATION |
|---|---|---|
| Shopify | Platform the app runs on; app installation and billing | Global |
| Vercel | Hosting of the app and website | App functions in the EU (Dublin, Ireland); website served from a global edge network |
| Supabase | Database | London, UK |
| Trigger.dev | Background jobs (scheduled scans, alerts, maintenance) | See provider |
| OpenRouter and the model provider it routes to | Optional AI suggestions; no storage of or training on your data | See provider |
| Resend | Sending email (weekly summary, alerts, waitlist emails) | See provider |
Our database runs in London (UK) and our app functions in Dublin (Ireland). Some providers may process data in other countries, including the United States. Where personal data leaves the EEA or the UK, we rely on an adequacy decision or on safeguards such as the EU Standard Contractual Clauses (with the UK addendum where UK law applies). If you use Slack alerts, alerts are delivered to the Slack webhook you provide, under your own agreement with Slack.
6. How long we keep data
- Scan history and resolved findings: 90 days. Your most recent scan is kept while the app is installed.
- Discount change records and storefront insight counters: 90 days. Product pairs bought together: 180 days after they were last seen.
- Incoming webhook records: 30 days. Security and lifecycle audit events: up to 365 days.
- If you uninstall: access is removed immediately. Scan results and settings — everything stored for your shop — are deleted when Shopify sends the data erasure request (shop/redact), about 48 hours later.
- Waitlist emails: until you unsubscribe or ask us to delete them, or until we no longer need them to tell you about the launch.
7. Security
Data is encrypted in transit (TLS) and at rest by our database provider. The database is not publicly accessible, access is limited to what the service needs, and secrets are kept out of our code. No method of transmission or storage is perfectly secure, but we work to protect your data and will tell affected merchants without undue delay if a breach affects their data. More detail is on our security page.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent at any time. To use these rights, email privacy@checkoutleak.com. If your question is about a store’s customers, please contact that store: the merchant controls that data. You also have the right to complain to your local data protection authority.
CheckoutLeak is a business tool and is not directed at children.
9. Changes to this policy
We will update this page when our practices change and adjust the date above. If a change materially affects how we handle merchant data, we will tell merchants in the app or by email before it takes effect.
10. Contact
Privacy questions and requests: privacy@checkoutleak.com. Everything else: support.